How to read email headers

Email headers are the delivery record attached to a message. They show how a receiving server evaluated authentication, the route the message took, and some of the encryption details used in transit. They are the most useful place to start when a test email does not behave as expected.

Paste a raw header into the free email header analyzer to read its reported SPF, DKIM, DMARC, routing, and TLS results locally in your browser.

Quick answer

Open the raw source for a message sent to a mailbox you control. Find the Authentication-Results header first, then check the newest Received lines to understand the route. A healthy test often shows spf=pass, dkim=pass, and dmarc=pass, but you should read the domains alongside each result.

Those results are the receiving server's report. They do not independently prove that every recipient will make the same decision.

Where to find raw headers

In Gmail, open the message, select the three-dot menu, then choose Show original. In Outlook desktop, open the message and look under File → Properties → Internet headers. Other clients use labels such as “view source,” “view message details,” or “show raw message.”

Copy the full header block, beginning with the topmost fields and including every Received line.

Start with Authentication-Results

This header commonly contains the receiving server's evaluation of email authentication. Look for:

spf=pass
dkim=pass
dmarc=pass

A pass tells you the server accepted that specific check. The detail beside it names the relevant domain, selector, or sending identity. For DMARC, confirm that the result applies to the domain your recipient saw in the From address.

A missing result is not always a failure. Forwarding, internal routing, and provider-specific handling can change which headers appear.

Read the Received lines from bottom to top

Each mail server normally adds a Received line as it handles the message. The oldest entry is usually at the bottom, while the most recent receiving hop is at the top.

Use these lines to answer practical questions:

• Which system submitted the message?
• Did it pass through the expected sending provider?
• Was an unexpected relay involved?
• Are the timestamps plausible for the delivery path?

Do not use a single unfamiliar hostname as proof of a problem. Mail routing can include provider infrastructure that does not resemble your domain.

Check SPF, DKIM, and DMARC together

SPF checks whether the sending host is authorized for an envelope identity. DKIM checks a cryptographic signature. DMARC evaluates alignment between the visible From domain and an authenticated SPF or DKIM identity.

If SPF fails, use the SPF checker to inspect the published record. If DKIM fails, confirm the provider's selector and public key record. If DMARC fails, check that a passing SPF or DKIM domain aligns with the visible From domain.

What headers cannot tell you

Headers are evidence from a delivered message. They do not guarantee inbox placement for future recipients, show your full sender reputation, or replace provider-specific diagnostics.

Use them with a test plan: send from each provider you use, test the actual From and bounce domains, and record the results before increasing outreach volume.

Frequently asked questions

Why is Authentication-Results missing?

Some providers omit it, and forwarding or internal routing can change headers. Try a test sent directly to another mailbox you control.

Can I safely share raw headers?

Review them first. Headers can contain email addresses, message IDs, internal hostnames, and routing details. Remove information you do not intend to share.

Does an SPF, DKIM, and DMARC pass guarantee inbox placement?

No. Authentication helps, but recipients also apply reputation, content, engagement, and local filtering rules.